Cloud Storage Encryption with Personal Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage systems lack effective methods to prevent unencrypted data from being accessed by unauthorized users, including service providers, and suffer from duplicate data storage and upload issues.
Innovation Solution
A method where data is encrypted with a storage key, which is further encrypted using two different methods to generate a personal key and a data key, allowing only the data owner to decrypt and access their data, while using HASH values to identify duplicates and prevent redundant storage and uploads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored unencrypted in cloud storage, then data access and retrieval are simple and fast, but data security is compromised and unauthorized users including service providers can access the data
Solution Approach 1:
The encryption system is segmented into multiple independent components: data encryption module, key generation module, and key storage module. The data is encrypted with a storage key, and the decryption key is further encrypted with the user's public key to generate a personal key. This segmentation ensures that even if one component is compromised, the overall security remains intact.
Solution Approach 2:
The patent introduces an intermediary encryption layer using the user's public key to protect the storage key. The personal key acts as an intermediary that bridges the user's credentials and the storage key, ensuring that the service provider cannot access the unencrypted data even though they manage the storage infrastructure.
2Productivity
If the service provider maintains the storage key for easy data management, then data retrieval is efficient, but the service provider can access unencrypted data compromising user privacy
Solution Approach 1:
The decryption capability is extracted from the service provider and transferred to the user through the personal key mechanism. The service provider only stores and manages the encrypted personal keys, not the unencrypted storage keys. This extraction ensures that the service provider cannot access unencrypted data while still enabling efficient data retrieval when the user provides their credentials.
3Quantity of substance
If duplicate data is stored and uploaded in cloud storage, then data redundancy increases storage capacity utilization, but it wastes storage space and upload bandwidth
Solution Approach 1:
The system performs preliminary comparison of data to be uploaded with existing stored data using cryptographic hashing or other comparison techniques. If duplicate data is detected before the upload process completes, the system prevents the redundant upload, thereby saving storage space and bandwidth while maintaining data availability.
Data Source
AI summary
The present invention discloses a security control method of network storage to ensure that the unencrypted data cannot be figured out from all information stored on the server. The method includes: encrypting, the private key of a user using a user credential and storing the encrypted private key in a server; encrypting data using a storage key, when uploading the data to the server, encrypting the decryption key corresponding to the storage key using the public key of the user, and submitting the encrypted data and the encrypted decryption key to the server.